Remote Backends & Team Collaboration

Chapter 5 flagged two problems with local state: secrets sitting in a file tempting to accidentally commit, and no shared record for a team. Remote backends solve both.

Why Local State Breaks With a Team

A second teammate cloning the repository has zero record of what the first person's apply already created — their local terraform.tfstate simply doesn't exist yet. Worse, if two people do somehow share a state file and both run apply at nearly the same time, each reads the same starting state, computes a plan against it, and both try to write an updated state back afterward — whichever write happens last silently overwrites the other, potentially losing track of resources the first apply just created.

Remote Backends

A backend block inside terraform {} moves state storage off local disk entirely, into a shared, access-controlled location every team member and CI runner reads from and writes to.

The S3 + DynamoDB Backend

The classic AWS pattern: an S3 bucket holds the state file itself (with encrypt = true for encryption at rest — the same principle dbsec1-5/crypto1-5/6 already covered), and a DynamoDB table provides locking. Every teammate and CI job reads/writes the exact same object in S3, so there's genuinely one shared source of truth instead of N different local copies.

State Locking

Before writing to state, Terraform first acquires a lock — a conditional write to the DynamoDB table that only succeeds if no lock currently exists. If someone else's apply already holds the lock, Terraform blocks with a clear error rather than racing to write state at the same time:

This is exactly what prevents the concurrent-write corruption described above — only one apply can ever be mid-flight against a given piece of state at a time.

Terraform Cloud / HCP Terraform

A managed alternative to hand-rolling S3+DynamoDB — built-in state storage, locking, a web UI, and run history, with no separate bucket or lock table to provision yourself. Genuinely the "batteries included" option, at the cost of depending on a hosted service rather than infrastructure the team fully owns.

Backend Migration

Switching from local state to a remote backend (or between two remote backends) isn't automatic — it requires an explicit migration:

After migrating, every teammate needs to re-run terraform init themselves — their local Terraform still points at the old backend configuration until they do.

Hands-On Exercises